For decades, network security worked like a castle. A firewall at the edge, a trusted inside, and an untrusted outside. If you were on the internal network, you were assumed to be legitimate.
Remote work, cloud services, contractors, and personal devices dissolved that boundary. Zero trust is the model that replaced it, and despite being the most oversold term in security, the underlying idea is sound and simple.
The Core Idea
Trust is never granted based on network location. Every request to every resource is evaluated on its own, every time, using everything known at that moment: who the user is, what device they are on, how they authenticated, what they are asking for, and what the risk signals say.
The slogan is never trust, always verify. The more useful version is that being on the network should give you nothing.
That principle is not new. It is least privilege applied to network access, and least privilege has been in security textbooks since the 1970s. What changed is that the technology to enforce it at scale finally became practical.
Where the Standard Came From
The term was popularized by John Kindervag at Forrester around 2010. Google published its own implementation, BeyondCorp, starting in 2014, which showed the model working at very large scale and removed the argument that it was theoretical.
The reference document is NIST Special Publication 800-207, Zero Trust Architecture, published in August 2020. It is free, it is readable, and it is vendor neutral, which makes it the right thing to read before talking to anyone selling a product.
In the United States, Executive Order 14028 in May 2021 pushed federal agencies toward zero trust, which is a large part of why the term became unavoidable in vendor marketing after that.
The Moving Parts
NIST describes the architecture in terms of a policy decision point and a policy enforcement point. The decision point evaluates a request against policy. The enforcement point sits in the path and does what the decision says.
Feeding the decision are inputs: identity from your directory, device posture from your endpoint management or EDR, threat intelligence, data classification, and activity logs.
Every zero trust product is some combination of those pieces. Understanding the split makes product comparisons far easier, and it is covered in more depth in policy enforcement points.
The Principles That Matter in Practice
Verify explicitly. Authenticate and authorize based on all available signals, not on a subnet.
Use least privilege access. Just enough access, just in time, with an expiry. See identity and access management.
Assume breach. Design as though an attacker is already inside, which changes what you build. It means segmentation, encryption between internal services, and monitoring of east to west traffic, not just north to south.
What It Looks Like When Implemented
Strong identity everywhere, with phishing resistant multi factor authentication and single sign on as the front door.
Device posture as a condition of access, so an unmanaged or non compliant laptop cannot reach sensitive systems even with valid credentials.
Application level access instead of network level access, which is what ZTNA replacing the VPN means in practice.
Microsegmentation inside the network so a compromised host cannot reach everything.
Continuous evaluation, so a session that becomes risky is re-checked rather than trusted until it expires. And logging of everything, because the whole model depends on being able to see what happened.
What Zero Trust Is Not
It is not a product. No single purchase gives it to you, regardless of what the box says.
It is not the same as ZTNA, although vendors use them interchangeably. ZTNA is one enforcement technology within a zero trust approach.
It is not the end of firewalls. Firewalls are enforcement points, and they remain important. See next generation firewalls.
And it is not a project with an end date. It is an architecture direction, and every organization sits somewhere on a spectrum rather than being done or not done.
A Realistic Implementation Order
Start with identity. Single sign on, phishing resistant multi factor authentication, and a clean picture of who has access to what. Nothing else works without this, and it delivers the biggest immediate reduction in risk.
Build an inventory of applications, data, and devices. You cannot write access policy for things you cannot list, which is why asset management keeps reappearing.
Replace flat remote access with per application access for your highest value systems first.
Add device posture as a condition. Then segment, starting with the crown jewels rather than trying to segment everything at once.
Then improve continuously: tighten policy, add signals, remove standing privileges. Organizations that try to do all of this at once generally stall, and the ones that pick the highest risk access path and fix it properly tend to keep going.
Reading Vendor Claims
Every network and security vendor now sells zero trust. The useful questions are which of the NIST components the product actually provides, what signals it can consume, what it can enforce and where it sits in the traffic path, and what happens when it fails.
That last one matters. An enforcement point in the path of all traffic is a single point of failure, and the failure mode, open or closed, is a decision you should make rather than discover.
Learn This at HackRange
The mentorship starts with packets, routing, and the Linux firewall precisely so that this material makes sense rather than being a set of slogans.